Description of problem: The systemd service libvirt-guests.service is designed to shut down or suspend running guest vms when the host is shut down. The service was recently fixed to work at all (#843836), but now the selinux policy is preventing it to work. The service does several calls to virsh, which in turn checks and contacts libvirtd. This is then blocked by the selinux targeted policy. Version-Release number of selected component (if applicable): # rpm -q libvirt libvirt-0.9.11.5-3.fc17.x86_64 # rpm -q selinux-policy selinux-policy-3.10.0-145.fc17.noarch How reproducible: always Steps to Reproduce: 1. virsh start xyz 2. setenforce permissive 3. systemctl stop libvirt-guests.service 4. grep virsh /var/log/audit/audit.log | grep denied Actual results: type=AVC msg=audit(1345982037.969:27): avc: denied { getattr } for pid=2922 comm="virsh" path="/usr/sbin/libvirtd" dev="sda2" ino=728072 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:virtd_exec_t:s0 tclass=file type=AVC msg=audit(1345982037.969:28): avc: denied { write } for pid=2922 comm="virsh" name="libvirt-sock" dev="tmpfs" ino=8141 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=sock_file type=AVC msg=audit(1345982037.998:29): avc: denied { read } for pid=2933 comm="virsh" name="libvirt.conf" dev="sda2" ino=2314770 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:virt_etc_t:s0 tclass=file type=AVC msg=audit(1345982037.998:29): avc: denied { open } for pid=2933 comm="virsh" path="/etc/libvirt/libvirt.conf" dev="sda2" ino=2314770 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:virt_etc_t:s0 tclass=file type=AVC msg=audit(1345982037.998:30): avc: denied { write } for pid=2933 comm="virsh" name="libvirt-sock" dev="tmpfs" ino=8141 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:virt_var_run_t:s0 tclass=sock_file type=AVC msg=audit(1345982037.998:30): avc: denied { connectto } for pid=2933 comm="virsh" path="/run/libvirt/libvirt-sock" scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:system_r:virtd_t:s0-s0:c0.c1023 tclass=unix_stream_socket type=AVC msg=audit(1345982043.188:33): avc: denied { getattr } for pid=3032 comm="virsh" path="/usr/sbin/libvirtd" dev="sda2" ino=728072 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:virtd_exec_t:s0 tclass=file Expected results: no denied calls Additional info: audit2allow suggests the following changes to policy: allow virsh_t virt_etc_t:file { read open }; allow virsh_t virt_var_run_t:sock_file write; allow virsh_t virtd_exec_t:file getattr; allow virsh_t virtd_t:unix_stream_socket connectto;
Did you try to create a local policy module with this rules?
(In reply to comment #1) > Did you try to create a local policy module with this rules? yes, then everything works as expected for me. But I just run qemu/kvm virtualization on my machine. It may be that it still fails with any of the other virtualization backends that libvirt supports. I think the codepaths and syscalls used within virsh to connect to them are different then.
Fixed in selinux-policy-3.10.0-148.fc17
I had to add this in order to get everything to work after updating to -148.fc17: allow virsh_t virtd_exec_t:file getattr;
I can confirm Kennys report: # rpm -q selinux-policy selinux-policy-3.10.0-148.fc17.noarch when stopping the libvirt-guests service I get this denied message in the audit log: type=AVC msg=audit(1346528581.292:51): avc: denied { getattr } for pid=5176 comm="virsh" path="/usr/sbin/libvirtd" dev="sda1" ino=1587265 scontext=system_u:system_r:virsh_t:s0 tcontext=system_u:object_r:virtd_exec_t:s0 tclass=file adding this to the policy fixes the problem: allow virsh_t virtd_exec_t:file getattr;
Added also a rule for this AVC msg.
selinux-policy-3.10.0-149.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/selinux-policy-3.10.0-149.fc17
Package selinux-policy-3.10.0-149.fc17: * should fix your issue, * was pushed to the Fedora 17 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing selinux-policy-3.10.0-149.fc17' as soon as you are able to. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-14301/selinux-policy-3.10.0-149.fc17 then log in and leave karma (feedback).
selinux-policy-3.10.0-149.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.